"Updates" dir. is deleted if you have used auto-update.
If you use manual update, you should delete the dir. manually as well.
Thanks for pointing out at this. We will add a note to our update manual.
Leaving the dir. should not cause serious security issues. In worst case some people can use direct update URL in their scripts, which might effect site performance.